[safenestdev]

What changes for users

Fixed

• getUsageSummary() returned an object whose declared fields were all undefined. UsageSummary now matches the response (apiKeyId, tier, date, usage{ totalRequests, successRequests, errorRequests }, quota{ requestsPerMinute, requestsPerMonth, requestsPerDay, remainingToday }), and the method accepts an optional date (YYYY-MM-DD). The old fields stay on the type, optional and @deprecated, so existing code still compiles.
• UsageMonthlyResult carries the optional verification block that enterprise verification plans receive.
• PricingPlan reads isPopular / ctaLink, ConsentRecord and AuditLogEntry read userId, as the API spells them; the old snake_case names are deprecated. ConsentRecord gains ip_hash; AuditLogEntry gains ip_hash, user_agent, _encrypted, and details is typed as the string the API sends. AccountExportResult gains incompleteCollections / unverifiedCollections.
• Incidents: IncidentStatus is new | reviewed | escalated | resolved | dismissed, IncidentSeverity is low | moderate | high | critical, and a new IncidentCategory union lists all 16 categories. The IncidentStatus and RiskCategory enums gain the missing values. List filters still accept the older medium and reviewing spellings. Incident rows gain recommended_actions, policy_action, recommended_status, escalation_capped(_reason), speaker_stance, action_capped(_reason) and is_test (test traffic).
• Reviews: new_risk_level / new_risk_category take the values the API accepts. batchReviewIncidents requires moderator_external_id (the API already rejected calls without it), and both review methods now check for it before sending.
• Audit receipts: moderator_review.action includes resolve and reopen; payloads gain harm_descriptor and external_ref.

Added

• getDsaTransparencyReport({ from, to, format? }): the DSA transparency report data as a typed JSON object, or the CSV as text with format: 'csv'.
• getStatus(), ping(), pingComponent(component): public health endpoints. A 503 is returned as a typed answer (status: 'major_outage' / healthy: false), not thrown, and never retried.
• getFleet(), getFleetDevice(deviceId): device attestation reads for the org behind the API key.
• getApiKeyQuota().

Internally, request now delegates to a shared send step so the text path and the status path reuse the same timeout, header and error handling.

Tests

tests/account.test.ts pins each wire shape. Fixtures are typed with the SDK's own interfaces, so type-only mismatches show up in tsc; runtime assertions pin paths, query strings, 503 handling and validation. Two existing reviewIncident tests called it without moderator_external_id (a field the type already required) and were updated.

Before the fix

npx vitest run tests/account.test.ts: 18 failed | 11 passed (29)

       × passes the date as a query parameter
       × hits GET /api/v1/account/api-keys/quota
       × IncidentStatus names every status an incident can hold
       × RiskCategory names every incident category
       × batchReviewIncidents requires moderator_external_id before calling the API
       × reviewIncident requires moderator_external_id before calling the API
       × returns the JSON report for a period
       × returns the CSV as raw text
       × surfaces a plan refusal on the CSV path as a typed error
       × validates the period dates
       × getStatus returns a major outage (HTTP 503) without throwing or retrying
       × ping hits GET /status/ping
       × pingComponent returns an unhealthy component (HTTP 503) without throwing or retrying
       × pingComponent throws NotFoundError for an unknown component
       × pingComponent validates the component name
       × getFleet hits GET /api/v1/agent/fleet
       × getFleetDevice hits GET /api/v1/agent/fleet/:deviceId
       × getFleetDevice validates the device id

tsc over src + tests/account.test.ts: 43 errors, including:

tests/account.test.ts(66,13): error TS2353: Object literal may only specify known properties, and 'apiKeyId' does not exist in type 'UsageSummary'.
tests/account.test.ts(82,42): error TS2554: Expected 0 arguments, but got 1.
tests/account.test.ts(103,17): error TS2353: Object literal may only specify known properties, and 'verification' does not exist in type 'UsageMonthlyResult'.
tests/account.test.ts(138,17): error TS2561: Object literal may only specify known properties, but 'isPopular' does not exist in type 'PricingPlan'. Did you mean to write 'is_popular'?
tests/account.test.ts(153,17): error TS2561: Object literal may only specify known properties, but 'userId' does not exist in type 'ConsentRecord'. Did you mean to write 'user_id'?
tests/account.test.ts(175,17): error TS2322: Type 'string' is not assignable to type 'Record<string, unknown>'.
tests/account.test.ts(235,17): error TS2353: Object literal may only specify known properties, and 'recommended_actions' does not exist in type 'IncidentSummaryRow'.
tests/account.test.ts(283,17): error TS2578: Unused '@ts-expect-error' directive.
tests/account.test.ts(293,13): error TS2578: Unused '@ts-expect-error' directive.
tests/account.test.ts(322,21): error TS2322: Type '"reopen"' is not assignable to type '"confirm" | "dismiss" | "downgrade" | "escalate" | "reclassify"'.
tests/account.test.ts(330,36): error TS2339: Property 'external_ref' does not exist on type 'AuditReceiptPayload'.

After the fix

npx vitest run tests/account.test.ts   Tests  29 passed (29)
tsc over src + tests/account.test.ts   0 errors
npx vitest run                         Tests  175 passed (175)   (baseline: 146)
npm run build                          clean

Closes #60

[lena-sabadina]

Reviewed the type and client changes. Wire shapes are pinned by tests, deprecated fields stay for compatibility, CI is green and the full suite passes locally.